'\" t
.TH VNSTAT 1 "MAY 2025" "version 2.14" "User Manuals"
.SH NAME
vnstat \- a console-based network traffic monitor

.SH SYNOPSIS

.B vnstat
.RB [ \-5bDedhlmqstvy? ]
.RB [ \-\-95th ]
.RB [ \-\-add ]
.RB [ \-\-alert
.IR "output exit type condition limit unit" ]
.RB [ \-\-begin
.IR date ]
.RB [ \-\-config
.IR file ]
.RB [ \-\-days
.RI [ limit ]]
.RB [ \-\-db
.IR file ]
.RB [ \-\-dbdir
.IR directory ]
.RB [ \-\-dbiflist
.RI [ mode ]]
.RB [ \-\-debug ]
.RB [ \-\-end
.IR date ]
.RB [ \-\-fiveminutes
.RI [ limit ]]
.RB [ \-\-help ]
.RB [ \-hg ]
.RB [ \-\-hours
.RI [ limit ]]
.RB [ \-\-hoursgraph ]
.RB [ \-i
.IR interface ]
.RB [ \-\-iface
.IR interface ]
.RB [ \-\-iflist
.RI [ mode ]]
.RB [ \-\-json
.RI [ mode ]
.RI [ limit ]]
.RB [ \-\-limit
.IR limit ]
.RB [ \-\-live
.RI [ mode ]]
.RB [ \-\-locale
.IR locale ]
.RB [ \-\-longhelp ]
.RB [ \-\-merge
.IR "source destination" ]
.RB [ \-\-months
.RI [ limit ]]
.RB [ \-\-oneline
.RI [ mode ]]
.RB [ \-\-query
.RI [ mode ]]
.RB [ \-\-rateunit
.RI [ mode ]]
.RB [ \-\-remove ]
.RB [ \-\-rename
.IR name ]
.RB [ \-ru
.RI [ mode ]]
.RB [ \-\-setalias
.IR alias ]
.RB [ \-\-short ]
.RB [ \-\-showconfig ]
.RB [ \-\-style
.IR number ]
.RB [ \-\-top
.RI [ limit ]]
.RB [ \-tr
.RI [ time ]]
.RB [ \-\-traffic
.RI [ time ]]
.RB [ \-\-version ]
.RB [ \-\-xml
.RI [ mode ]
.RI [ limit ]]
.RB [ \-\-years
.RI [ limit ]]
.RI [ interface ]

.SH DESCRIPTION

.B vnStat
is a console-based network traffic monitor. It keeps a log of 5 minute interval,
hourly, daily, monthly and yearly network traffic for the selected interface(s).
However, it isn't a packet sniffer. The traffic information is read from the
.BR proc (5)
or
.B sys
filesystems depending on availability resulting in light use of system resources
regardless of network traffic rate. That way vnStat can be used even
without root permissions on most systems.
.PP
Functionality is divided into two commands. The purpose of the
.B vnstat
command is to provide an interface for querying the traffic information stored
in the database whereas the daemon
.BR vnstatd (8)
is responsible for data retrieval, caching and storage. Although the daemon
process is constantly running as a service, it is actually spending most of its
time sleeping between data updates.

.SH OPTIONS

.TP
.B "--95th"
Show 95th percentile output for the ongoing month. This output uses the 5 minute resolution
data of the ongoing month to calculate the 95th percentile traffic rate for received, transmitted
and total. In addition, the minimum, average and maximum traffic rates for received, transmitted
and total are also shown. This output requires the
.B 5MinuteHours
configuration option to have a value of at least 744 for storing all the necessary data, otherwise 100% coverage
isn't possible.

.TP
.B "--add"
Create database entry for interface specified with
.B \-i
or
.B \-\-iface
option. The daemon can be running during this operation and will automatically
start monitoring the interface without a restart within
.B SaveInterval
minutes if configuration option
.B RescanDatabaseOnSave
is enabled. Otherwise the daemon needs to be restarted in order for the
added interface to be monitored.

.TP
.BI "--alert " "output exit type condition limit unit"
Depending on values of given parameters, show alert, use different exit
status or a combination of both when configured situation is met.

.IP
.I output
parameter takes a number from 0 to 3 and controls when, if at all, the command
will result in output. '0' never produces output, '1' always produces output, '2'
shows output only when usage estimate exceeds
.I limit
and '3' shows output only when
.I limit
is exceeded.

.IP
.I exit
parameter takes a number from 0 to 5 and controls the exit status of the
command. '0' always uses exit status 0, '1' always uses exit status 1, '2'
uses exit status 1 if usage estimate exceeds
.I limit
but otherwise exit status 0 and '3' uses exit status 1 if
.I limit
is exceeded but otherwise exit status 0. '4' and '5' are equivalents of '2'
and '3' with the difference that exit status 2 is used instead of exit
status 1 when the condition is met. This can help differentiate alerts from
errors as errors will always use exit status 1.

.IP
.I type
parameter defines to which time range type usage the
.I limit
is compared against. Available options: 'h', 'hour', 'hourly', 'd', 'day', 'daily', 'm', 'month', 'monthly', 'y', 'year', 'yearly', 'p', '95', '95%'.

.IP
.I condition
parameter defines if
.I limit
is compared to received (rx), transmitted (tx), total or estimated usage of these three.
Available options: 'rx', 'tx', 'total', 'rx_estimate', 'tx_estimate', 'total_estimate'.
Estimate options aren't available for 95th percentile
.IR type .

.IP
.I limit
is a greater than zero integer without decimals which defines the traffic usage
limit using the unit defined with the
.I unit
parameter.
.I unit
accepts the following options: 'B', 'KiB', 'MiB', 'GiB', 'TiB', 'PiB', 'EiB', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB'.
For 95th percentile
.I type
the following options are available: 'B/s', 'KiB/s', 'MiB/s', 'GiB/s', 'TiB/s', 'PiB/s', 'EiB/s', 'kB/s', 'MB/s', 'GB/s', 'TB/s', 'PB/s', 'EB/s', 'bit/s', 'Kibit/s', 'Mibit/s', 'Gibit/s', 'Tibit/s', 'Pibit/s', 'Eibit/s', 'kbit/s', 'Mbit/s', 'Gbit/s', 'Tbit/s', 'Pbit/s', 'Ebit/s'.
Usage must exceed
.I limit
in order for the alarm to activate. Exactly the same usage as
.I limit
does not raise the alarm.

.IP
Estimate calculation isn't limited to the estimate options
in
.I condition
parameter but can also be achieved by using the estimate option in
.I output
or
.I exit
parameters. Missing or invalid parameters or parameter combination will result in
.B "--alert"
specific help output being shown.

.TP
.BI "-b, --begin " date
Begin the list output with a specific date / time defined by
.I date
instead of the begin being selected based on the number of entries to be shown.
If
.I date
isn't available in the database then the closest later date will be used.
.I date
supports the following formats: YYYY-MM-DD HH:MM, YYYY-MM-DD and "today".
This option can only be used with
.B "--json"
,
.B "--xml"
and list outputs.

.TP
.BI "--config " file
Use
.I file
as configuration file instead of using automatic configuration file search
functionality. If
.B "--config"
is used multiple times, the configuration settings from files later on the command line
will override configuration settings loaded from earlier files if the settings defined
in the files overlap.

.TP
.BI "-d, --days " [limit]
Show traffic statistics on a daily basis for the last days. The length of the list
will be limited to 30 entries unless configured otherwise or unless the optional
.I limit
parameter is used. All entries stored in the database will be shown if
.I limit
is set to 0.

.TP
.BI "--db " file
Use
.I file
as database file instead of searching for a database from the directory specified in
the configuration file or the hardcoded default if no configuration file is available.
This option overrides
.BR "--dbdir" .

.TP
.BI "--dbdir " directory
Use
.I directory
as database directory instead of using the directory specified in the configuration
file or the hardcoded default if no configuration file is available. This option is
ignored if
.B "--db"
is also defined.

.TP
.BI "--dbiflist " [mode]
List interfaces currently in the database. If
.I mode
is not defined or is set to 0 then the output will use a one line verbose format. If
.I mode
is set to 1 then the output will contain one interface per line and if
.I mode
is set to 2 then only the interface count will be shown as a single number. See also
.BR "--iflist" .

.TP
.B "-D, --debug"
Show additional debug output. Can be used multiple times for increased verbosity up to a maximum of 2.

.TP
.BI "-e, --end " date
End the list output with a specific date / time defined by
.I date
instead of the latest date / time in the database. If
.I date
isn't available in the database then the closest earlier date will be used.
.I date
supports the following formats: YYYY-MM-DD HH:MM and YYYY-MM-DD.
This option can only be used with
.B "--json"
,
.B "--xml"
and list outputs. In list outputs the estimate line is replaced with
a sum line with values representing the sums of each column. The sum line is
shown only if the output consists of more than one data line. This is applicable
even if the defined
.I date
is the same as the current date. The top list also requires
.B "--begin"
to be used at the same time with this option.

.TP
.BI "-5, --fiveminutes " [limit]
Show traffic statistics with a 5 minute resolution for the last hours.  The length of the list
will be limited to 24 entries unless configured otherwise or unless the optional
.I limit
parameter is used. All entries stored in the database will be shown if
.I limit
is set to 0.

.TP
.BI "-h, --hours "  [limit]
Show traffic statistics on a hourly basis. The length of the list will be limited
to 24 entries unless configured otherwise or unless the optional
.I limit
parameter is used. All entries store in the database will be shown if the
.I limit
is set to 0.

.TP
.B "-hg, --hoursgraph"
Show traffic statistics on a hourly basis for the last 24 hours using a bar graph
followed by a table representing the numerical data.

.TP
.BI "-i, --iface " interface
Select one specific
.I interface
and apply actions to only it. For database queries, it is possible to merge the
information of two or more interfaces using the
.I interface1+interface2+...
syntax. All provided interfaces must be unique and must exist in the database
when the merge syntax is used. Optionally, depending on the
.B InterfaceMatchMethod
configuration setting,
.I interface
can be replaced with
.I alias
previously set using
.BR "--setalias" .
Merge syntax isn't supported when
.I alias
is used. The
.B "-i, --iface"
option is optional and
.I interface
can be used as parameter on the command line for selecting the used interface
even without the option being explicitly used.

.TP
.BI "--iflist " [mode]
List currently available interfaces. If
.I mode
is not defined or is set to 0 then the output will use a one line verbose format. If
.I mode
is set to 1 then the output will contain one interface per line and if
.I mode
is set to 2 then only the interface count will be shown as a single number. See also
.BR "--dbiflist" .

.TP
.BI "--json " "[mode] [limit]"
Show database content for selected interface or all interfaces in json format. All
traffic values in the output are in bytes unless otherwise indicated by the name of the key. An optional
.I mode
parameter can be used for limiting the output to only selected information.
Everything except the 95th percentile output is shown by default. Setting
.I mode
to 's' will output a summary containing the last 2 entries of 5 minute, hourly,
daily, monthly and yearly resolution data, 'f' will output only 5 minute
resolution entries, 'h' hours, 'd' days, 'm' months, 'y' years, 't' the top
days and 'p' the 95th percentile. Alternatively or in combination with
.I mode
an optional
.I limit
parameter can be used to limit the number of entries in the output. The
.BI "--json"
option can be used in combination with
.B "-l, --live"
and
.B "-tr"
options without
.I mode
or
.I limit
having any effect to the output. The
.B "jsonversion"
field in the output contains the API version information. It will be changed only when the
names or structures of previously existing content gets changed. In comparison, the
.B "vnstatversion"
field exists only as extra information.

.TP
.BI "--limit " limit
Set the maximum number of shown entries in list outputs to
.IR limit .
Usage of
.B "--limit"
overrides the default list entry limit values and the optional
.I limit
parameter given directly for a list query. All entries stored in the database will be shown if
.I limit
is set to 0.
.B "--limit"
can also be used to control the length of
.B "--json"
and
.B "--xml"
outputs.

.TP
.BI "-l, --live " [mode]
Display current transfer rate for the selected interface in real time
until interrupted. Statistics will be shown after interruption if the runtime
was more than 10 seconds. An optional
.I mode
parameter can be used to select between the displaying of packets per
second (mode 0) and transfer counters (mode 1) during execution.
.B "--style"
can also be used to affect the layout of the output. The output will be in json
format if used in combination with
.B "--json"
option.

.TP
.BI "--locale " locale
Use
.I locale
instead of using the locale setting specified in the configuration file or the system
default if no configuration file is available.

.TP
.B "--longhelp"
Show complete options list.

.TP
.BI "--merge " "source destination"
Merge interface data from
.I source
database to
.I destination
database. Unless interfaces are specified, all interfaces from
.I source
will be merged to
.IR destination .
A new database will be created if
.I destination
doesn't exist. If an interface of the same name doesn't exist in
.I destination
then a direct copy action for the data from
.I source
will be executed. If an interface of the same name already exists in
.I destination
then an additive merge action will be executed. The
.I source
database is always accessed as read-only and will never be modified by the merge actions. Changes
to the
.I destination
database cannot be reversed as subtraction actions aren't supported. Execution of the merge needs
to be acknowledged with an additional parameter. If this additional parameter isn't provided then
a preview of the actions with additional guidance will be shown.

.IP
Both
.I source
and
.I destination
can either refer directly to database files or use an alternative
.I file:interface
syntax where the database file is suffixed with
.I ":"
followed with an interface name. When used as
.IR source ,
the alternative syntax allows specifying one interface to be merged from
.I source
to
.I destination
instead of all interfaces being merged. Additionally, it's possible to use
the alternative syntax in
.I destination
for specifying to which interface the data will be merged to.

.TP
.BI "-m, --months " [limit]
Show traffic statistics on a monthly basis for the last months. The length of the list
will be limited to 12 entries unless configured otherwise or unless the optional
.I limit
parameter is used. All entries stored in the database will be shown if
.I limit
is set to 0.

.TP
.BI "--oneline " [mode]
Show traffic summary for selected interface using one line with a parsable
format. The output contains 15 fields with ; used as field delimiter. The 1st
field contains the API version information of the output that will only be changed
in future versions if the field content or structure changes. The following
fields in order 2) interface name, 3) timestamp for today, 4) rx for today,
5) tx for today, 6) total for today, 7) average traffic rate for today,
8) timestamp for current month, 9) rx for current month, 10) tx for current
month, 11) total for current month, 12) average traffic rate for current month,
13) all time total rx, 14) all time total tx, 15) all time total traffic.
An optional
.I mode
parameter can be used to force all fields to output in bytes without the
unit itself shown.

.TP
.BI "-q, --query " [mode]
Force database query mode. An optional
.I mode
parameter can be used to override the default query mode. 'a' results in
short summary output being used when there are more than one interface in the
database, otherwise regular summary output is used. 's' results in regular
summary output being shown for one interface regardless of the number of interfaces
in the database. When the optional
.I mode
parameter isn't defined, the configured
.I QueryMode
will be used instead.

.TP
.B "--remove"
Delete the database entry for the interface specified with
.B \-i
or
.B \-\-iface
and stop monitoring it. The daemon can be running during this operation
and will automatically detect the change.

.TP
.BI "--rename " name
Rename the interface specified with
.B \-i
or
.B \-\-iface
in the database with new name
.BR name .
The new name cannot already exist in the database. This operation doesn't
cause any data loss. The daemon should not be running during this operation.

.TP
.BI "-ru, --rateunit " [mode]
Swap the configured rate unit. If rate has been configured to be shown in
bytes then rate will be shown in bits if this option is present. In the same
way, if rate has been configured to be shown in bits then rate will be shown
in bytes when this option is present. Alternatively,
.I mode
with either 0 or 1 can be used as parameter for this option in order to
select between bytes (0) and bits (1) regardless of the configuration file setting.

.TP
.BI "--setalias " alias
Set
.I alias
as an alias for the selected interface to be shown in queries. The set
alias can be removed by specifying an empty string for
.IR alias .
The daemon can be running during this operation.

.TP
.B "-s, --short"
Use short output mode. This mode is also used when more than one interface is
available in the database and no specific interface is selected.

.TP
.B "--showconfig"
Show current configuration using the same format as the configuration file
itself uses.

.TP
.BI "--style " number
Modify the content and style of outputs. Set
.I number
to 0 for a narrower output, 1 for enabling bar column, 2
for same as previous but with average traffic rate visible in summary
output and 3 for enabling average traffic rate in all outputs where it is
supported. 4 disables the use of terminal control characters in
.B "-l, --live"
and
.B "-tr, --traffic"
modes.

.TP
.BI "-t, --top " [limit]
Show all time top traffic days. The length of the list will be limited to 10
entries unless configured otherwise or unless the optional
.I limit
parameter is used. All entries stored in the database will be shown if
.I limit
is set to 0. When used with
.B "--begin"
and optionally with
.BR "--end" ,
the list will be generated using the daily data instead of separate top entries.
The availability of daily data defines the boundaries the date specific query
can access.

.TP
.BI "-tr, --traffic " [time]
Calculate how much traffic goes through the selected interface during
the given
.I time
seconds. The
.I time
will be 5 seconds if a number parameter isn't specified. The output will
be in json format if used in combination with
.B "--json"
option. However, in that case, the countdown before results isn't shown.
.B "--style"
can also be used to affect the layout of the output.

.TP
.B "-v, --version"
Show current version.

.TP
.BI "--xml " "[mode] [limit]"
Show database content for selected interface or all interfaces in xml format. All
traffic values in the output are in bytes unless otherwise indicated by the name of the key. An optional
.I mode
parameter can be used for limiting the output to only selected information.
Everything except the 95th percentile output is shown by default. Setting
.I mode
to 's' will output a summary containing the last 2 entries of 5 minute, hourly,
daily, monthly and yearly resolution data, 'f' will output only 5 minute
resolution entries, 'h' hours, 'd' days, 'm' months, 'y' years, 't' the top
days and 'p' the 95th percentile. Alternatively or in combination with
.I mode
an optional
.I limit
parameter can be used to limit the number of entries in the output. The
.B "xmlversion"
field in the output contains the API version information. It will be changed only when the
names or structures of previously existing content gets changed. In comparison, the
.B "vnstatversion"
field exists only as extra information.

.TP
.BI "-y, --years " [limit]
Show traffic statistics on a yearly basis for the last years. The list will show all
entries by default unless configured otherwise or unless the optional
.I limit
parameter is used. All entries stored in the database will also be shown if
.I limit
is set to 0.

.TP
.B "-?, --help"
Show a command option summary.

.SH FILES

.TP
.I /var/lib/vnstat/
Default database directory.

.TP
.I /etc/vnstat.conf
Config file that will be used unless
.I $HOME/.vnstatrc
exists. See
.BR vnstat.conf (5)
for more information.

.SH EXAMPLES

.TP
.B "vnstat"
Display traffic summary for the default interface or multiple interfaces
when more than one is monitored.

.TP
.B "vnstat -i eth0+eth1+eth3"
Display traffic summary for a merge of interfaces eth0, eth1 and eth3.

.TP
.B "vnstat -i eth2 --xml"
Output all information about interface eth2 in xml format.

.TP
.B "vnstat --json"
Output all information of all monitored interfaces in json format.

.TP
.B "vnstat -i eth0 --setalias local"
Give interface eth0 the alias "local". That information will be
later visible as a label when eth0 is queried.

.TP
.B "vnstat -i eth2 --remove"
Delete database entries for interface eth2 and stop monitoring it.

.SH RESTRICTIONS

Updates need to be executed at least as often as it is possible for the interface
to generate enough traffic to overflow the kernel interface traffic counter. Otherwise,
it is possible that some traffic won't be seen. With 32-bit interface traffic counters,
the maximum time between two updates depends on how fast the interface can transfer 4 GiB.
Note that there is no guarantee that a 64-bit kernel has 64-bit interface traffic counters
for all interfaces. Calculated theoretical times are:
.RS
.TS
l l.
10 Mbit:        54 minutes
100 Mbit:        5 minutes
1000 Mbit:      30 seconds
.TE
.RE
.PP
Virtual and aliased interfaces cannot be monitored because the kernel doesn't
provide traffic information for that type of interfaces. Such interfaces are
usually named eth0:0, eth0:1, eth0:2 etc. where eth0 is the actual interface
being aliased.
.PP
Using long date output formats may cause misalignment in shown columns if the
length of the date exceeds the fixed size allocation.

.SH AUTHOR

Teemu Toivola <tst at iki dot fi>

.SH "SEE ALSO"

.BR vnstatd (8),
.BR vnstati (1),
.BR vnstat.conf (5),
.BR proc (5),
.BR ifconfig (8),
.BR units (7)
